RomCom Execution Guardrail Domain Check
Detects a process launching from a common user-writable directory that subsequently makes an external network connection. This behavior is consistent with malware, such as the Mythic agent used by RomCom, that performs an execution guardrail check (e.g., verifying the host's domain name) before initiating command and control communications.
YARA-L
